package com.security;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.authority.GrantedAuthoritiesContainer;

public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
	@Override
	protected void configure(HttpSecurity http) throws Exception {
		super.configure(http);
		http.authorizeRequests()
				.antMatchers("/", "/login").permitAll()//设置对路径不拦截
				.anyRequest().authenticated()//任何请求,登录后可以访问
				.and()
				.formLogin()
				.loginPage("/login")//在没有授权前，任何访问需要授权才能访问的页面都会先跳转到/login登录页面
				.defaultSuccessUrl("/chat")//登录成功后转向chat
				.permitAll()//登录页面用户任意访问
				.and()
				.logout()
				.permitAll();
	}

	/**
	 * 在内存中分配用户
	 * 一般有自己的用户管理
	 */
	@Override
	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
		super.configure(auth);
		auth.inMemoryAuthentication().withUser("wyf").password("wyf").roles("USER	")
				.and().withUser("wisely").password("wisely").roles("USER");
//		auth.userDetailsService()
//		GrantedAuthoritiesContainer
	}

	/**
	 * /resources/static目录下静态资源不拦截
	 */
	@Override
	public void configure(WebSecurity web) throws Exception {
		super.configure(web);
		web.ignoring().antMatchers("/resources/static/**");
	}
}
